Take-aways: Suspicious Activity Reports (SARs) filed by major cryptocurrency exchanges stand out from those filed by other types of MSBs. Cryptocurrency exchanges located in San Francisco filed more Suspicious Activity Reports than all securities firms and casinos combined. Cryptocurrency exchanges appear to have trouble classifying activity into existing SAR categories.
Identifying Cryptocurrency Exchange Suspicious Activity Reports
San Francisco County (‘SFC’) is the 66th most populous county in the US with a headcount on par with Erie County (Buffalo), NY. While SFC is not home a huge number of people, it is the home to huge cryptocurrency exchanges. Coinbase, Binance.us, OKcoin and Kraken’s FinCEN registrations all reflect SFC addresses.
Cryptocurrency exchanges are lumped into the Money Services Business (‘MSB’) industry category on the Suspicious Activity Report form. FinCEN’s SAR Stats data also groups cryptocurrency exchanges with other types of MSBs.
FinCEN notes that when a SAR Form does not contain an entry for the State of branch or office where activity occurred that instead geographic data will be pulled from Financial Institution’s Permanent State Address. Cryptocurrency exchanges don’t have branch offices, hence all of their Suspicious Activity Reports reflect the permanent office location.
Therefore, I analyzed aggregate data for SARs filed in San Francisco County by MSBs to identify those likely to have been reported by cryptocurrency exchanges.
With many caveats in mind, below is what I was able to suss out.[i]
How Many Suspicious Activities Reports did Cryptocurrency Exchanges File?
Before we get to cryptocurrency exchange SARs, it’s helpful to know that over 3 million SARs were filed in 2021 by all financial institutions combined. Depository Institutions (banks and credit unions) filed 46% of all SARs. Other industry categories include Securities/Futures and Casinos, with 58,951 and 54,937 SARS respectively.
MSBs were the second largest industry filer with 1,137,454 unique SARs in 2021. Cryptocurrency exchanges Suspicious Activity Reports are included in the MSB total.
In 2021, SFC MSBs filed 206,527 SARs. Only two years ago there were 14,845 Suspicious Activity Reports filed by the same group. We should sub-tract at least 15,000 to 25,000 of the 2021 SARs as being filed by non-crypto exchanges since that was the range filed pre-2020.
That leaves approximately 180,000 SARs filed by cryptocurrency exchanges with SFC permanent addresses.
Cryptocurrency exchanges located in SFC filed more Suspicious Activity Reports in 2021 than all Securities/Futures/Insurance firms, Casinos, Loan Companies, and Housing GSEs combined.
What Suspicious Activities do Cryptocurrency Exchanges Report?
A handful of activity categories accounted for the majority of Suspicious Activity Reports filed by the cryptocurrency exchanges. SARs can reflect more than one suspicious activity. SFC MSBs reported 2.5 suspicious activities per SAR.
The table below lists Suspicious Activity categories where San Francisco County MSBs account for at least 30% of all MSB SAR filings in 2021.
Transactions with No Apparent Economic, Business or Lawful Purpose
The leading suspicious activity category for cryptocurrency exchanges is Transactions with No Apparent Economic, Business of Lawful Purpose. San Francisco MSBs filed 194,859 SARs for this category in 2021 and accounted for 72% of all MSB SARs for this category. This suspicious activity category skyrocketed from only 7,714 filed in San Francisco in 2019.
Cryptocurrency layering activity could appear to be Transactions with No Business Purpose.
Money launderers can use Layering-As-A-Service software that will programmatically move cryptocurrency through multiple addresses that are, in fact, under common control. It is routine for criminals to layer transactions through tens, hundreds and even thousands of wallets to make it more difficult to trace.
Elliptic noted:
You do not need to provide your identity when creating a wallet, and you can easily create thousands or millions of wallets, in seconds.
Money launderers have exploited this to layer cryptoassets through hundreds of wallets using automated processes. This essentially mimics the fiat method of blurring or obfuscating the trail back to the original illicit source of funds.
Similarly, Suspicious Use of Multiple Accounts is the 6th most reported Suspicious Activity Report category for crypto exchanges. San Francisco MSBs accounted for 67% of all SARs filed in this category.
Unregistered / Unlicensed MSB
Cryptocurrency exchanges filed an estimated 98% of all Unregistered MSB SARs. This is the second most frequently filed suspicious activity category for cryptocurrency exchanges with more than 65,000 in 2021.
The good news is that registered cryptocurrency exchanges are detecting unregistered cryptocurrency exchanges. The bad news is that the horde of unregistered cryptocurrency exchanges are likely non-compliant with AML obligations.
See my Unregistered Cryptocurrency Exchange SARs post for an in-depth look at this issue.
Unclassified Activity: Other Suspicious Activity
Cryptocurrency exchanges appear to have trouble classifying suspicious activity into existing SAR categories. There were 61,821 Other: Other Suspicious Activities SARs filed in SF County in 2021. This is ten times greater than 2nd place New York County, NY with 6,688 SARs filed. Crypto exchanges also had a tougher time specifically classifying activity than FinTech hub, Santa Clara County, CA.
Alternatively, the total number of SARs reported by all broker-dealers across the entire country is fewer than the number of SARs that cryptocurrency exchanges couldn’t categorized.
What Activities are Cryptocurrency Exchanges Not Finding?
The leading suspicious activity category across all MSBs is Transaction(s) Below BSA Recordkeeping Threshold with over 525,827 filed in 2021. San Francisco MSBs filed about 1% of these SARs. Similarly, cryptocurrency exchanges are not filing Suspicious Use of Multiple Transaction Locations SARs.
The cryptocurrency exchange business model is quite different from that of traditional MSBs. There are no branch offices, there are no customers walking in with cash [with the exception of bitcoin ATMs], and no customers are conducting multiple transactions at multiple locations to avoid BSA reporting thresholds.
Suspicious Activities that Cryptocurrency Exchanges Should Re-examine
Concerningly few SARs were filed by cryptocurrency exchanges in the following categories:
Wash Trading. Fraudsters coordinate trading of cryptocurrency or NFTs to manipulate trading volume or asset price. Wash-trading within and by cryptocurrency exchanges has also been the subject of news reports and enforcement actions. Yet, cryptocurrency exchanges filed zero Wash Trading Suspicious Activity Reports.
Ponzi schemes. San Francisco MSBs filed 84 Ponzi Scheme SARs in 2021. While the SAR count is comparable to banks and securities firms, the SEC and DOJ have been very active in prosecuting crypto-related Ponzi schemes.
Cyber Event Against Financial Institution and Customers. San Francisco MSBs file 5, yes 5, Cyber Event Against Financial Institution SARs. Yet you can’t go a week without reading about the latest cryptocurrency exchange hack. Customer-targeted cyber-attacks saw 67 SARs which is also laughable. By comparison, Securities/Futures firms reported over 4,500 Cyber Event SARs in 2021.
Corruption (Foreign & Domestic) and Bribery. These three categories had a combined 13 SARs filed in 2021 by SF MSBs. Cryptocurrency has many attractive features for use in bribery/corruption including cross-border flow, large dollar amounts and pseudonymity. With the White House’s big anti-corruption push, cryptocurrency exchanges should make sure they are identifying this activity.
SAR Usefulness to Law Enforcement?
There is currently one catch-all SAR Industry category for all MSBs. Mom-and-pop check cashers, MoneyGram, ApplePay, and Binance.us are all lumped together in the MSB Industry category.
Compare this to casinos where there is differentiation between card clubs, state casinos and tribal casinos. Similarly, SARs for Depository Institutions can be analyzed by their primary regulator: OCC, FRB, FDIC or NCUA.
Right now, there is no simple way to analyze SAR filings for cryptocurrency exchanges and other types of VASPs. Yet, cryptocurrency exchanges claim to transact billions in crypto each day and have millions of customers.
Without access to SAR filing data for all cryptocurrency exchanges, there is no way to know if these financial institutions are filings Suspicious Activity Reports in scale with their size or risk exposure.
[i] This analysis uses San Francisco County FinCEN-registered Money Services Businesses as a proxy for cryptocurrency exchanges located in SFC. SAR Counts downloaded from FinCEN SAR Stats. All analysis, charts, and graphs prepared by Dynamic Securities Analytics, Inc.
The following caveats apply: (1) there is no cryptocurrency exchange Industry category on the SAR form, (2) many cryptocurrency exchanges are located outside of SFC and even outside of the US, (3) legacy (ex. convenience store check cashers) are located in SFC, so county-wide stats includes SARs filed those types of MSBs, (4) crypto exchanges are not the only type of VASP, (5) more than one branch office can be associated with a SAR, and (6) there is no cryptocurrency or virtual asset financial instrument category on the SAR form.
If FinCEN added a cryptocurrency exchange / VASP category to the SAR form, this analysis would be much easier.
Want more Suspicious Activity Report Insights?
Read DSA’s 2020, 2019, 2018 and 2016 SAR Insights.
Read DSA’s analysis on Unregistered Cryptocurrency Exchange SARs.
Watch “How Covid-19 Impacted SARs“.
Want to learn more about Suspicious Activity Report geographic data?
Are Nebraskans Really the Most Suspicious People in the Nation? – Dynamic Securities Analytics, Inc.
